Bugtraq mailing list archives

Buffer Overflow in uucp of SunOS 5.8


From: hipnosis hipnosis <hipnosis () softhome net>
Date: 13 Jan 2003 19:08:12 -0000



Hi everybody

Though I dont know if this vulnerability has be discovered previously I 
found a buffer overflow in the app uucp of SunOS 5.8 that it could be used 
to get privileges of uucp.

Buffer is overflow when the app uucp is executed with the parameter -s 
continued of a string bigger than 7525 bytes.

hipnosis% uucp -s `perl -e 'print "A"x7526'`
Segmentation Fault
hipnosis% uucp -s `perl -e 'print "A"x7525'`
hipnosis%

I have not been able to debug the app for see if the registers are 
overwrites because i have not any debugger in my machine and i have not 
too time.

My system:
hipnosis% uname -a
SunOS averroes 5.8 Generic_108528-03 sun4u sparc SUNW,Ultra-250
hipnosis% 

Suid:
hipnosis% ls -l /usr/bin/uucp
---s--x--x   1 uucp     uucp       66940 eno   5  2000 /usr/bin/uucp
hipnosis% 

Well, bye everybody




           


Current thread: